Ex-CIA Officials To New York Times: Don't Try To Hold The CIA Accountable. The CIA Will Hold The CIA Accountable.

from the w/special-guest-Michael-D'Andrea,-drone-strike-architect dept

Prominent alumni of the intelligence community have a problem with the New York Times publishing the name of the CIA's drone strike "architect." Although Michael D'Andrea's connection to the program had been sussed out nearly two years earlier and was apparently common knowledge to the governments of countries CIA drones launched from, the CIA still didn't want his name publicly disclosed. Their officials pushed New York Times executive editor Dean Baquet. He pushed back.

Now, a letter to the editor signed by 20 ex-CIA officials is arguing that Baquet was wrong to do so. The attendant irony of known "leakers" Leon Panetta and David Petraeus signing this indignant ode to CIA secrecy can't be allowed to pass without noting. Panetta handed off plenty of classified information, including names of personnel operating under "cover," to the makers of Zero Dark Thirty. Petraeus handed over eight notebooks full of sensitive info to his mistress/biographer. Both have escaped any serious repercussions for their actions. But they're righteously pissed that Baquet published the name of the person overseeing the CIA's drone strike program.

The letter is a mess. If it's meant to make a solid argument for members of media acquiescing to every government request to withhold information, it fails spectacularly. If anything, it helps demonstrate why those whose powers are shrouded by layers of opacity should be exposed more often.

When your lead-off acknowledges that you're more angry than informed, you're going to fail to land solid blows. Pointing to Dean Baquet's interview with the Lawfare blog in which he defended his actions, the 20 ex-CIA officials all agree they really haven't done their homework.

We profoundly disagree — not because we have analyzed this particular case (we have not), but because in our view he misstates the purpose of cover generally.

But rather than moving on to correcting this perceived error, the letter instead shifts to arguing that the law Baquet didn't violate should actually have been violated, if only Congress hadn't have screwed up more than three decades ago.

Congress overwhelmingly enacted the Intelligence Identities Protection Act of 1982 precisely to protect the dedicated men and women whose lives would be at risk if their names became widely publicized.

What Congress could not have anticipated at the time, of course, is that any name published in The Times would reside forever on the Internet, searchable by any terrorist with a laptop. It is true that certain foreign governments may know their names, but that is altogether different from making the name accessible to ISIS, Al Qaeda and every other murderer on the planet.

The law contains loopholes that apply to Baquet's actions, as Lawfare's Jack Goldsmith points out. These ex-officials are now stating these loopholes shouldn't apply. Because the Internet. And this assertion is backed up by the portrayal of said internet as infested with "every other murderer on the planet." This hyperbole is expected, as is the intelligence community's confidence that it -- and only it -- knows what Congress did or didn't foresee when passing laws related to surveillance and spycraft.

In this particular case, Congress couldn't have foreseen an easily-searchable internet when passing a 1982 law. Fair enough, I suppose, but governing entities like Congress and the judicial system are immediately granted Nostradamus-esque powers of foresight whenever it works to the advantage of the entities performing long-delayed interpretations of Congressional intent. This same "power" is revoked the moment it becomes inconvenient to those seeking expanded powers with a minimum of accountability.

The letter then goes on to claim the press has no business attempting to increase government accountability. It's doing a fine job of policing itself, thank you very much.

Officials who work on covert operations do not escape accountability. Their actions are carefully reviewed by the C.I.A.’s general counsel, the inspector general, White House officials, congressional overseers and Justice Department attorneys.

Would this be the same CIA general counsel that cleared the CIA of all wrongdoing in the Senate spying debacle? Are these the same DOJ attorneys who couldn't be bothered to examine the Senate's claims of CIA spying during the creation of the Torture Report? Is this the same government that finally admitted it was wrong to torture people but refused to hold anyone accountable for the CIA's abuse of detainees? Is this the same vaunted oversight that seemed constantly surprised by the programs detailed in Snowden's leaks?

"Oversight" is a word covert agencies use when they don't want anyone taking a closer look at their programs or operations. When these officials point to "oversight," all they're really pointing to is the skeletal framework that remains after years and years of deliberately weakening oversight standards and processes. No one believes the government has the capability -- much less the desire -- to hold these agencies accountable for their actions. And the agencies know this.

The New York Time's refusal to grant continued secrecy to the man behind the agency's transformation into an efficient, impersonal killing machine may not result in direct responses from the oversight these officials claim works oh so well, but at least it prevents them from pretending they have no idea who was behind the program.

Filed Under: cia, classified, david petreaus, drones, journalism, leaks, leon panetta, michael d'andrea, reporting, under cover
Companies: ny times

If There Needs To Be An Investigation, It Should Be About Why The FBI Was Reading Certain Emails

from the friendly-fire dept

While some have noted the irony of General Petreaus being taken down due to online surveillance methods that he should have been aware of, the case is bringing growing attention to an issue many of us have been discussing for a while: how easy it is for law enforcement to snoop through your email. We raised the question already, but as more info comes out, the whole thing is looking that much more questionable.

Julian Sanchez keeps trying to find out exactly what legal process the FBI used to go through a variety of email accounts based on an apparently non-criminal cyberstalking claim (which was apparently brought to the FBI by a non-cyber-focused agent who had seemed to have a crush on the "victim"of the cyberstalking), and notes that there are big questions about what process was used to go through these emails and how much oversight was involved:

To Julian Sanchez, a research fellow at the Cato Institute, the real scandal over the Petraeus affair is not the extramarital sex, but the invasion of privacy.

"Law enforcement and certainly intelligence agencies have an incredible amount of ability to gather huge volumes of detailed information about people's most intimate online communications, a lot of it without requiring a full-blown warrant, a lot of it without requiring even any kind of judicial approval," Sanchez said.

Meanwhile, Chris Soghoian, working for the ACLU, highlights some of what's been revealed about the snooping. For example, FBI agents tracked down Patricia Broadwell as the email sender, even though she was using throwaway accounts, because webmail providers record the IP address from whence someone logs in -- and Broadwell didn't conceal that info. Apparently, the IP addresses were a series of hotels, and cross-checking with guest lists, it didn't take long to narrow down the only real suspect. Oh, and none of that info required judicial oversight for the FBI to get:

The guest lists from hotels, IP login records, as well as the creative request to email providers for “information about other accounts that have logged in from this IP address” are all forms of data that the government can obtain with a subpoena. There is no independent review, no check against abuse, and further, the target of the subpoena will often never learn that the government obtained data (unless charges are filed, or, as in this particular case, government officials eagerly leak details of the investigation to the press). Unfortunately, our existing surveillance laws really only protect the “what” being communicated; the government’s powers to determine “who” communicated remain largely unchecked.

He also delves into the method by which Petreaus and Broadwell communicated -- by sharing an account and communicating via "drafts" that were saved. For the head of the CIA you'd think he'd use a method that wasn't long known to be just as (if not more) insecure than regular email. Soghoian tears apart this supposedly "secret" method of communicating:

For more than a decade, a persistent myth in Washington DC, fueled by several counterterrorism experts, has been that it is possible to hide a communications trail by sharing an email inbox, and instead saving emails in a “draft” folder. This technique has been used by Khaled Sheikh Mohammed, Richard Reid (the shoe bomber), the 2004 Madrid train bombers, terrorists in Germany, as well as some domestic “eco-terrorists.” This technique has appeared in federal court documents as early as 2003, and was described in a law journal article written by a DOJ official in 2004. It is hardly a state secret.

Apparently, this method was also used by General Petraeus. According to the Associated Press, “[r]ather than transmitting emails to the other's inbox, they composed at least some messages and instead of transmitting them, left them in a draft folder or in an electronic ‘dropbox,’ the official said. Then the other person could log onto the same account and read the draft emails there. This avoids creating an email trail that is easier to trace.”

The problem is, like so many other digital security methods employed by terrorists, it doesn’t work. Emails saved in a draft folder are stored just like emails in any other folder in a cloud service, and further, the providers can be compelled, prospectively, to save copies of everything (so that deleting the messages after reading them won’t actually stop investigators from getting a copy).

Ironically enough, by storing emails in a draft folder, rather than an inbox, individuals may be making it even easier for the government to intercept their communications. This is because the Department of Justice has argued that emails in the “draft” or “sent mail” folder are not in “electronic storage” (as defined by the Stored Communications Act), and thus not deserving of warrant protection. Instead, the government has argued it should be able to get such messages with a mere subpoena.

Got all that? It's even more info that the FBI may have been able to obtain without ever having to get approval from a judge. That's not to say they didn't necessarily go before a judge to get a warrant or similar tool for surveillance, but it does highlight just how much info the FBI can obtain without any real oversight, and how it's entirely possible for it to be abused -- taking a very limited situation (non-criminal online harassment) and turning it into something massive.

In fact, as the EFF's Trevor Timm notes, we should be investigating the FBI over why it was snooping through people's emails and how frequently it does this. He notes, as others have, that nothing about the origination of this case should have resulted in FBI involvement, let alone reading people's emails. Remember, early on, no one knew this had anything to do with General Petreaus or any other high ranking official:

The spark that set events in motion was a handful of allegedly harassing emails sent anonymously to Kelley, a friend of Petraeus's, which she brought to a friend at the FBI. Yet it's unclear why an investigation was ever opened, given that everything publicly known about the emails suggests they weren't illegal.

As the Daily Beast reported, they said things like "Who do you think you are? ... You parade around the base ... You need to take it down a notch." The story noted, "when the FBI friend showed the emails to the cyber squad in the Tampa field office, her fellow agents noted that the absence of any overt threats."

It seems the deciding factor in opening the investigation was not the emails' content, but the fact that the FBI agent was friendly with Kelley. (Even more disturbing, the same FBI agent has now been accused of becoming "obsessed" with the Tampa socialite, sent shirtless pictures to her, and has been removed from the case.)

Basically, it sounds like the FBI had very questionable reasons for digging all that deep into this case at all. Michael Davis, at the Daily Beast, notes that the emails were typical "cat-fight stuff," with no indication of illegal activity:

When the FBI friend showed the emails to the cyber squad in the Tampa field office, her fellow agents noted that the absence of any overt threats.

“No, ‘I’ll kill you’ or ‘I'll burn your house down,’” the source says. “It doesn’t seem really that bad.”

The squad was not even sure the case was worth pursuing, the source says.

“What does this mean? There’s no threat there. This is against the law?” the agents asked themselves by the source’s account.

At most the messages were harassing. The cyber squad had to consult the statute books in its effort to determine whether there was adequate legal cause to open a case.

“It was a close call,” the source says.

So while there's all sorts of talk of investigations into who should have known the details of what was going on at what time, no one seems to be questioning why a simple "cat fight" resulted in the FBI digging in and reading people's emails. Yet, that seems like something we should all be quite worried about.

Indeed, if there's any "benefit" to come out of this, perhaps it's that more and more people are hopefully realizing just how easy it is for the FBI to spy on people electronically.

Filed Under: david petreaus, email snooping, fbi, oversight, privacy, subpoenas, warrants

How Much Did The FBI Snoop On Email Messages To Uncover The Petreaus Situation?

from the all-for-what? dept

As you're probably aware since it's "the big story" right now, General David Petreaus stepped down last week after an FBI investigation turned up an affair he'd been having. It seems that every few hours more news "breaks" on the story, and it keeps getting more involved, with a growing number of players (and with each new revelation the story gets more and more bizarre). However, some have started wondering how and why the FBI was snooping on various emails. The original story was that it came about after Petreaus' mistress allegedly sent threatening (anonymous) emails to another woman, who reported them to the FBI. From that came a wider investigation, which supposedly may involve another General and a variety of other players. But some are realizing that this seems to show how the FBI has pretty free rein in terms of snooping on email accounts hosted online:

Under the 1986 Electronic Communications Privacy Act, federal authorities need only a subpoena approved by a federal prosecutor — not a judge — to obtain electronic messages that are six months old or older. To get more recent communications, a warrant from a judge is required. This is a higher standard that requires proof of probable cause that a crime is being committed.

But even that isn't entirely clear. Folks like Julian Sanchez have been puzzling through the timeline of events and wondering how a simple investigation into a small number of "rude" (but not illegal) emails then uncovered thousands of questionable emails involving a different general as alleged in the news that broke last night. It feels like the FBI may have taken a simple report of misconduct (which may have been driven by another love triangle issue involving an FBI agent who seemed to take the whole thing a lot more personally than makes sense) and turned it into a massive fishing expedition.

Given how fast new parts of this story keep breaking, I'm sure there are still a number of other dominoes to fall, but hopefully this actually gets people to pay attention to just how easy it is for law enforcement to snoop on people's emails these days based on next to nothing.

Filed Under: david petreaus, email, expa, fbi, snooping, warrants